If a security filter was built assuming attackers sneak text in at the end, what happens when they put it first?

This explores whether a defense built and tested against injected text added at the end of an input still works when the payload is placed at the start. The corpus's one direct test says not reliably. ChannelGuard's COMPRESS gate stopped 100% of leaks between agents but failed in 23.4% of cases at the user-prompt boundary Why does compression defense fail at the user prompt boundary?. The gate keeps the first two sentences of a message. That only makes sense if you assume injections trail the legitimate content. At the user prompt the user writes the payload first, so the part the gate preserves is where the payload sits.

The defense wasn't weak. It was tuned to a picture of the attacker, and that picture held for one channel and not another. The finding to take from it is that a sanitizer carries unstated assumptions about attacker behavior, and those assumptions change from channel to channel. Inter-agent traffic and user input look like the same problem, but they have different attackers with different habits. A benchmark that only tests one habit will report a perfect score.

The same pattern shows up elsewhere in the corpus, where the unit a defense inspects becomes the gap. Skill scanners score each skill on its own. An attacker who sees scanner feedback can lower the suspicion of every individual skill while the chain-level behavior stays intact, which reached 96% average attack success across six scanners Can attackers evade skill scanners by refining individual skills?. Multi-agent systems have the same blind spot. A harmful goal can be split into steps that each look harmless, with the harm appearing only when they're combined Can task decomposition hide harmful intent across agents?. One response proposes making the defended unit a revisable set of linked actions across executions, rather than each one reviewed in isolation Should defence units span multiple executions and agents?.

So how do you avoid a position assumption? The corpus points to defenses keyed to what content does rather than where it sits. RAGMask flags a document because its similarity collapses abnormally when tokens are masked, which doesn't depend on where a payload is placed Can we defend RAG systems from corpus poisoning without retraining?. Self-inspection can catch injected advertisement content without retraining Can language models be hijacked to embed hidden advertisements?. Neither was tested against prepended payloads, so treat them as candidates rather than fixes. Defenses can also be bypassed from below: the layer that picks which model handles a request sits under prompt-level defenses and can be manipulated on its own Can attackers manipulate which model handles a request?.

The corpus only has one head-to-head measurement of append versus prepend. It shows the gap but doesn't say how common it is across other defenses. A practical test for any defense is to ask what it assumes about where and how the attack arrives, then check that assumption on every channel it guards.